Shor's algorithm breaks ECDSA, RSA, and secp256k1 completely. Scan your npm dependencies and source code for quantum-vulnerable cryptography in seconds.
Every major Ethereum and Bitcoin npm package relies on ECDSA/secp256k1. None have a post-quantum migration path documented.
Catches vulnerable crypto at the dependency level and in your source code directly.
Maps your package.json against a curated database of 20+ crypto libraries and their underlying algorithms. Instant results, no source required.
Walks your JS/TS source via Babel AST to catch direct node:crypto calls — createSign('RSA-SHA256'), generateKeyPairSync('ec') — that dependency scanning misses.
Exits non-zero on critical findings. Use --threshold=70 to set a custom score gate. --ignore=ethers to skip specific packages.
If a post-quantum library is detected alongside vulnerable classical crypto — critical penalties are reduced by 50%. Two or more PQC libraries earns a +10 score bonus.
Use --html to generate a full HTML report or --csv to export findings to a spreadsheet. --json for CI integration.
Critical findings (broken by Shor's algorithm) are weighted heavily. Medium findings (weakened by Grover's) reduce the score proportionally.
Takes 10 seconds. No account required.